Threat reportData BreachTL-2026-4270
Capcom CAPCOM ID unauthorized access exposes 11.7M records; phishing warning issued
Capcom CAPCOM ID unauthorized access exposes 11.7M records (TL-2026-4270), also tracked as CAPCOM ID breach, is a high-severity data breach, first published 2026-10-23. It has no confirmed attribution, affects Capcom CAPCOM ID (membership/account service), maps to 6 MITRE ATT&CK techniques (T1078, T1098, T1531), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4270
- Threat ID
- TL-2026-4270
- Also known as
- CAPCOM ID breach
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- gaming, entertainment, consumer
- Target regions
- japan, Global
- Detection rules
- 9
- Indicators of compromise
- 11
How Capcom CAPCOM ID unauthorized access exposes 11.7M records works
Capcom detected unauthorized access to its CAPCOM ID membership service on 2026-10-19, exposing 11,774,247 records (email addresses and account-activity metadata including client IP addresses). Passwords were changed without authorization on 196 accounts, and Capcom warns of follow-on phishing impersonating the company. Credit card data was not affected.
On 2026-10-19 Capcom detected suspicious activity indicating potential unauthorized access to CAPCOM ID, the account service used across its online games and services, and confirmed the breach the same day. Per Capcom's 2026-10-22 notice, 11,774,247 records were exposed worldwide. The records contain email addresses and system identifiers: account creation date and time, last login date and time, number of logins and the client IP address used at last login. A further 43 of these records also contain date of birth, gender, country/region and nickname. Capcom states that credit card information was not affected.
Capcom confirmed unauthorized password changes on 196 accounts, which indicates the intruder had write-level capability over account credentials and not just read access. Capcom reset the passwords on those accounts. The company states it completed emergency blocking of the unauthorized access and has identified and addressed the method of attack. It has not disclosed that method, so the initial access vector, the vulnerability or credential type involved, the dwell time and the exfiltration mechanism are unknown. Services that use CAPCOM ID remain operational and the investigation is ongoing.
Response timeline: on 2026-10-20 Capcom set up an internal incident response headquarters and reported the incident to its IT Security Oversight Committee. On 2026-10-21 it reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission. The press notice was issued on 2026-10-22 with dedicated support channels for Japan, the Americas, EMEA and Asia/Oceania.
Downstream risk: the exposed email addresses combined with login metadata (last login, login count, IP address) give attackers material for credible phishing and account-takeover attempts against CAPCOM ID users and the platform accounts that can be linked to it (PlayStation, Xbox, Steam, Epic Games, Nintendo, per Malwarebytes). Capcom instructs recipients of suspicious messages impersonating Capcom not to open URLs or attachments. Malwarebytes recommends enabling authenticator-app two-factor authentication, reviewing account and linked-platform details, and visiting cid.capcom.com directly instead of following email links. No threat actor, malware, CVE or attacker infrastructure has been publicly attributed. Capcom's 2020 Ragnar Locker ransomware incident is a separate, earlier event and is not linked to this one in any source.
MITRE ATT&CK techniques used in TL-2026-4270
Initial Access
T1078 Valid Accounts; T1566 Phishing
Persistence
Impact
Reconnaissance
Affected products and versions in Capcom CAPCOM ID unauthorized access exposes 11.7M records
- Capcom — CAPCOM ID (membership/account service)
Vulnerable versions: Service-level compromise; exact component not disclosed
Fixed in: Capcom states the attack method has been addressed
Remediation for Capcom CAPCOM ID unauthorized access exposes 11.7M records
Patches
- Capcom states it has addressed the attack method; no vendor patch or CVE has been published
Immediate actions
- Treat any email, SMS or message claiming to be from Capcom with suspicion; do not open URLs or attachments in it (Capcom guidance)
- Access CAPCOM ID by typing cid.capcom.com directly rather than following links in messages
- Reset the CAPCOM ID password if it was reused on any other service
- Review CAPCOM ID account details and any linked platform accounts (PlayStation, Xbox, Steam, Epic Games, Nintendo) for unfamiliar changes
Workarounds
- Use Capcom's dedicated support channels (Japan: 0120-801-271, 10:00-20:00 JST; Americas: capcom-support.com request form; EMEA: feedback@capcom.com; Asia/Oceania: info-asia@capcom.com) to verify any suspected account tampering
Longer-term hardening
- Enable two-factor authentication with an authenticator app (e.g. Google Authenticator, Microsoft Authenticator) on CAPCOM ID and linked platform accounts
- Use a unique password per service, managed in a password manager
- Defenders: add email-security and brand-impersonation monitoring for Capcom-themed lures, and alert on unexpected password-change events
Timeline of Capcom CAPCOM ID unauthorized access exposes 11.7M records
- Capcom detected suspicious activity indicating potential unauthorized access to CAPCOM ID and confirmed the breach the same day.
- Capcom established an internal incident response headquarters and reported the incident to its IT Security Oversight Committee.
- Capcom reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.
- Capcom listed dedicated support channels for Japan (0120-801-271), the Americas (web form), EMEA (feedback@capcom.com) and Asia/Oceania (info-asia@capcom.com).
- Per the same notice, emergency blocking of the unauthorized access was completed, the 196 affected accounts had passwords reset, and the attack method was identified and addressed (completion dates not given). Services remain operational and the investigation is ongoing.
- Capcom published its official notice: 11,774,247 records exposed, 43 records with DOB/gender/country/nickname, 196 unauthorized password changes, and a phishing warning.
- Malwarebytes Labs published analysis and user guidance (enable 2FA, avoid email links, check linked platform accounts).
Sources cited for Capcom CAPCOM ID unauthorized access exposes 11.7M records
- Capcom official breach notice (11,774,247 records; 43 with DOB/gender/country/nickname; 196 unauthorized password changes)
- Resident Evil maker Capcom warns of phishing after 11.7 million records exposed (Malwarebytes Labs)
- Capcom 2021 update on the 2020 ransomware incident (prior, unrelated incident, context only)
- Capcom 2020 notice of unauthorized access (prior, unrelated incident, context only)
- Gaming Company Confirms Ragnar Locker Ransomware Attack (2020 incident, context only)
- Capcom Says Personal Data of Thousands More Stolen in Ransomware Attack (SecurityWeek, 2020 incident, context only)
Detection coverage for TL-2026-4270
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4270 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.